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Abstract: We develop a model for practical, entanglement-based long- 
distance quantum key distribution employing entanglement swapping as a 
key building block. Relying only on existing off-the-shelf technology, we 
show how to optimize resources so as to maximize secret key distribution 
rates. The tools comprise lossy transmission links, such as telecom optical 
fibers or free space, parametric down-conversion sources of entangled pho- 
ton pairs, and threshold detectors that are inefficient and have dark counts. 
Our analysis provides the optimal trade-off between detector efficiency and 
dark counts, which are usually competing, as well as the optimal source 
brightness that maximizes the secret key rate for specified distances (i.e. 
loss) between sender and receiver. 
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1. Introduction 

Quantum cryptography technologies have matured to commercial applications (TJ. Yet long- 
distance quantum communication and particularly long-distance quantum key distribution 
(QKD) are hampered by exponential channel loss of photons with respect to transmission dis- 
tance. Quantum relays J2][3j|4l[5 IE) and quantum repeaters [7| could solve these distance limits 
by exploiting entanglement swapping (ES) JU between photon pairs as a key building block. 
However, ES based on present technology is performance-limited due to real-world imperfec- 
tions. 

ES is achieved with two sources of entangled photon pairs (EPPs) and a joint Bell-state 
measurement (BSM) performed on two of their outputs, specifically one from each source. 
Realistic EPP sources are probabilistic, and occasionally emit two or more independent EPPs. 
Spontaneous parametric down-conversion (PDC) in nonlinear crystals is the most common way 
to produce EPPs. Detectors used to perform BSM are inefficient and suffer from dark counts. 
Aiming at realistic aspects of ES-based QKD, we have studied the effect of experimental im- 
perfections on ES -generated entangled quantum states (in terms of their fidelity with a target 
Bell state) via a non-perturbative mathematical model for practical ES accounting for detector 
inefficiencies, detector dark counts and multipair events J5J, Our closed-form solution for re- 
alistic ES-generated quantum states determines the "amount" of useful entanglement, which 
depends on experimental parameters such as dark-count rates and efficiencies of off-the-shelf 
detectors as well as brightness of PDC sources. This realism makes our model useful for plan- 
ning long-distance QKD experiments employing ES, which is demonstrated in this paper. 

The impact of real-world imperfections on the performance and communication range of 
QKD has been the objective of numerous recent investigations iflOl . In ifTTl Brassard et al. 
showed that channel losses, a realistic detection process, and qubit-source imperfections dras- 
tically impair the feasibility of QKD over long distances. In particular, it was shown in IfTTl 
that unconditional security is difficult to achieve in long-distance QKD based on the BB84 
protocol lfl2l realized by attenuated laser pulses instead of by idealized single-photon on- 
demand sources; in the same work, a superior performance was obtained for QKD schemes 
based on a single PDC source. The consequences of using probabilistic EPP sources (realized 
by PDC) instead of by single-pair on-demand sources for quantum communication including 
entanglement-based QKD have been investigated lfl3l fT4l [151 . 

For long distances, the entanglement-based BBM92 QKD protocol [16] with a single PDC 
source placed midway between the two communicating parties was shown to perform signif- 



icantly better than BB84-based QKD realized by faint coherent-state pulses under the restric- 
tion to individual eavesdropping attacks and trusted noisy detectors J3|. Even though faint- 
pulse BB84 QKD with decoy states (decoy-BB84 QKD) IT7l [TH1 US] [20l EU E21 permits much 
larger communication ranges than conventional faint-pulse BB84 QKD without decoy states, 
PDC-based BBM92 QKD with the source in the middle tolerates higher channel loss and thus 
enables longer communication distance than decoy-BB84 QKD lfl3l . setting aside the fact 
that the latter protocol can realize appreciably higher key-distribution rates than the former 
for medium- and low-loss settings. Moreover, for ideal EPP sources, ES-based BBM92 QKD 
schemes were proven to allow achieving even greater distances at the cost of smaller commu- 
nication rates |3][6). 

Here we extend our entanglement-swapping model |9) to practical QKD based on distribut- 
ing entangled photons over extended distances by ES and relying only on existing off-the-shelf 
technology. The resources we consider are (i) lossy transmission links, such as telecom optical 
fibers or free space, (ii) spontaneous PDC to produce EPPs and (iii) inefficient, noisy thresh- 
old detectors. We show how to employ these resources so as to optimize QKD performance. 
We determine the QKD figures of merit quantum bit error rate (QBER) and secret key rate 
as functions of experimental parameters. Our theory permits constrained optimization of the 
experimentally tunable detector efficiencies and dark count rates as well as brightness of PDC 
thereby yielding optimal QKD performance for any distance d between sender Alice and re- 
ceiver Bob. 

Determining optimal source brightness is important for both faint-pulse BB84 QKD and 
PDC-based BBM92 QKD. Low source brightness implies a low key-generation rate. How- 
ever, as the source brightness increases, the multiphoton-signal probability for faint-pulse BB84 
QKD or multipair probability for PDC-based BBM92 QKD rises. In faint-pulse BB84 QKD, 
multiphoton signals are vulnerable to photon number splitting (PNS) attacks which jeopardize 
QKD security. Decoy states |[T7l[T8l[T9ll20l ) are generally used as a remedy to tackle this prob- 
lem. Although PNS attacks do not help an eavesdropper in PDC-based BBM92 QKD BUS, 
occasional multipairs cause erroneous heralding events, thus contributing to QBER (see Sec. [2]). 

The optimal mean photon number per signal for faint-pulse coherent-state QKD can be deter- 
mined l20ll23l as well as the optimal source brightness for PDC-based BBM92 QKD with a sin- 
gle PDC source placed midway between sender and receiver 1131 . Although the effects of trans- 
mission losses, detector inefficiencies and dark counts on the performance of quantum relays 
has been examined (6|, the probabilistic nature of realistic EPP sources including occasional 
multipair events has not yet been incorporated. Our analysis yields optimal PDC-source bright- 
ness for PDC-based BBM92 QKD exploiting ES as a crucial tool (PDC-ES-BBM92 QKD) 
for any channel distance given an empirical constraint between efficiency and dark counts for 
common off-the-shelf detectors. 

Multi-excitation events, as significant sources of error, have been considered in other re- 
cent investigations that elaborate on practical implementations of the DLCZ quantum repeater 
scheme 1241 . The effects of multipair events in PDC, in addition to transmission losses, de- 
tector and quantum memory imperfections on quantum repeater performance, have been ac- 
counted for perturbatively 1251 . The atom-light entangled states produced by Stokes scattering 
in the DLCZ scheme are similar to the light-light entangled states produced by non-degenerate 
PDC, as both are two-mode squeezed states. In these works ll26l l27l l28l the impact of multi- 
excitation contributions in such atom-light entangled states has also been taken into account 
perturbatively. A more thorough analysis of multi-excitation events in atomic-ensemble memo- 
ries has been provided in |29l . Our theory is based on a substantially different approach, which 
is non-perturbative and uses the principle of Bayesian inference to account for the presence of 
experimental imperfections. 
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Fig. 1. Entanglement swapping based on two PDC sources and an interferometric BSM. 
Four spatial modes are involved: a, b, c and d. The modes b and c are combined at a 
balanced beamsplitter (BS). Outputs b' and c 1 are directed to polarizing beamsplitters (PBS) 
and then detected at four photon detectors: one for the H and one for the V polarization of 
each of the c' and b' modes. The detectors are inefficient and subject to dark counts. Their 
readout is denoted by {q\,qi, qi, q^}. In a QKD experiment (see Fig. [2}, the polarization- 
entangled photons of the remaining modes a and d are distributed between Alice and Bob, 
respectively, and the BBM92 protocol 1161 can be applied to make the secret key. 

Finally, we address the communication range and corresponding key generation rates 
achieved by PDC-ES-BBM92 QKD compared to decoy-BB84 QKD. In particular, we analyze 
the conjecture that there is no superiority of PDC-ES-BBM92 QKD over decoy-BB84 QKD 
with respect to achievable range for detectors with negligible dark counts. 

This paper is organized as follows. In Sec. [2] we identify the resources and describe how 
we incorporate real-world imperfections into our mathematical model. In Sec. [3] we demon- 
strate how to optimize the performance of PDC-ES-BBM92 QKD with respect to PDC sources 
and detectors. Sec.|4]provides a comparison between PDC-ES-BBM92 QKD and decoy-BB84 
QKD for negligibly small detector dark count rates. We conclude in Sec.[5]with a brief summary 
and important remarks. 

2. Identifying the resources 

The photon transmission probability is l(p a '/ 10 for a the loss coefficient (in dB/km) and / 
the distance the light travels. The loss differs depending on whether transmission is via fiber 
optics or free space. In this analysis we leave the loss coefficient unspecified and normalize the 
distance between sender and receiver through the product ad. For example, the loss coefficient 
for light of wavelength 1550 nm propagating through a telecom optical fiber is approximately 
a w 0.25 dB ktrr 1 0, so ad = 10 (a "10 dB loss") corresponds to d ps 40 km of fiber. 

Basic experimental ES is illustrated in Fig.Q] Two PDC sources emit photon pairs into spatial 
modes a and b (first PDC) and c and d (second PDC). For ES, a joint BSM is performed on 
the b and c modes. As a consequence, provided that a certain measurement readout occurs, the 
photons in outgoing modes a and d emerge entangled despite never having interacted with one 
another [8 1. The entanglement previously contained in the a and b and the c and d photon pairs, 
respectively, is swapped to the a and d photon pair. 



We assume type-I nondegenerate PDC as the generator of polarization-entangled quantum 
states 

| x ) a b = ex P [iX («h^h + aJ> H ) ] ® sxp[ix (alb I + a v b v ) ] | vac) ( 1 ) 

in two spatial modes a and b, where |vac) is the multimode vacuum state. Our analysis is 
straightforward to generalize to other types of entanglement. The parameter % <E R is propor- 
tional to the nonlinearity of the crystal, the strength of the pump laser and the interaction 
time between the pump laser and the medium, which is approximately the laser-pulse duration. 
The value of x 2 (the square of not to be confused with the crystal's x^ nonlinearity) is 
the probability for EPP generation within the time window of a laser pulse. Equivalently, x 2 
can be interpreted as the EPP production rate (brightness) of the PDC source. We assume the 
same brightness for both PDCs. The quantum state generated by the second PDC source is thus 
\X} c d> anc ' tne common quantum state prepared by two identical PDC sources is then given by 
\X)abcd = \X) a b ® \X)cd- Exceedingly small % values imply disadvantageously low EPP pro- 
duction rates; however, as % increases, the probability for harmful multipair events rises, which 
lead to faulty detection clicks and thus incorrect estimates of entanglement after ES. 

We model detector efficiency 77 (0 < r\ < 1) by preceding a fictitious unit-efficiency, dark- 
count-exempt photon-counting detector with a virtual beamsplitter of transmittance r\. We in- 
clude dark counts by a fictitious thermal background source of light incident on the second 
input port of the beamsplitter. Dark counts are incorporated by the dark count probability p dc 
per time window of the pump laser pulse in the PDC process. In our model transmission losses 
are included in detector efficiencies according to 77 = 770 lO - "'/ 10 , where rjo denotes the intrin- 
sic detector efficiency. 

Detector quality is important for long-distance QKD. On the one hand, detectors should be 
as efficient as possible to achieve fast key rates and high efficiency for ES operation. On the 
other hand, dark count noise should be low to make the QBER small. In experiments these 
two aims compete: rjo and p dc counteract for typical off-the-shelf detectors. Avalanche photo- 
diodes (APDs) are the most used photon detectors in long-distance quantum communication 
experiments over telecom optical fibres, with InGaAs/InP diodes being the most common. The 
trade-off between efficiency and dark counts for high quality InGaAs APD detectors at optical 
telecom wavelength 1550 nm can be characterized by the empirical relation 

p dc =Aexp(Bri( ) ) (2) 

with typical values A = 6.1 x 10~ 7 and B = 17 J6). For simplicity, we assume the same effi- 
ciency rjo and dark count probability p d „ respectively, for all detectors employed in the here 
considered QKD scheme, subject to the empirical constraint (0. 

In fact single-photon detectors other than APDs have been prototyped. Most notable are 
superconducting transition-edge sensors (TES), which are photon-number-resolving with up 
to 88% detection efficiency at 1550 nm and benefit from negligible dark count rates lf30l [3T1 
l32l . A further type with a demonstrated photon-number-resolving functionality is given by 
superconducting nanowire single-photon detectors (SNSPDs) |33l[34ll35ll36l , which combine 
a high infrared detection efficiency (up to 57% at 1550 nm 1341 ) with an ultra-low dark count 
rate and a high counting frequency 1361 . Such detectors (TES or SNSPDs) substantially increase 
the range, security and bit rate for QKD. However, a severe drawback of both TES and SNSPDs 
is the fact that they must be operated at cryogenic temperatures, which makes them impractical 
for off-the-shelf QKD technology. 

Transmission of polarization-encoded qubits naturally suffers from depolarization, i.e., 
environment-induced randomization of photon polarization. The amount of this depolarization 
depends on the properties of the quantum channel, i.e., on the specific fiber used for photon 



transmission or atmospheric conditions in the case of free-space QKD, as well as on the spec- 
tral band-width of the individual photons. Nevertheless, modern fibers affect the polarization 
far less than previously thought. High-fidelity transmission of polarization-encoded qubits from 
EPP sources is possible and was successfully demonstrated over 100 km of fiber f37l and in 
free space even up to 144 km (38!]. Such high-fidelity transmission can be extended to even 
greater distances by spectral filtering of the down-converted photons ||39ll40l . Moreover, var- 
ious implementations have demonstrated how to remedy birefringence-caused, time-varying 
unitary polarization transformations during photon transmission. Promising proposals include, 
e.g., real-time polarization control employing two nonorthogonal reference signals multiplexed 
in either time or wavelength with the data signal BTI as well as stabilization of unwanted qubit 
transformation in the quantum channel using quantum frames l42l . Hence, for distances up to 
100 km, and probably beyond this range, the degree of observed quantum correlations is limited 
mainly by detector dark counts and multi-pair emissions rather than by depolarization, which 
we neglect in the present analysis. 

Previously we derived a nonperturbative, closed-form solution for the quantum states 
^{?v} (^,{77 v } ) {|? (icv }) prepared by a realistic ES, given a recorded readout {q v } (e.g. 
{^i,^2,?3 7 ?4} in Fig. [TJ of a BSM with faulty detectors characterized by efficiencies {r) v } 
and dark count probabilities {p JcV } (V is a label for different detectors involved in the BSM), 
as a density-operator valued function of %, {rj v } and {^? dcv } [9j. Using this closed-form solu- 
tion, we can simulate a four-fold coincidence experiment. A direct measure for entanglement 
quantification after ES is the visibility V := (Max — Min)/(Max + Min), where "Max" and 
"Min" denote the maximum and minimum values of the four-fold coincidence rate as a func- 
tion of polarization angle. Provided that click events are observed in both the a and d modes, 
and restricting ourselves to the corresponding post-selected quantum states pj^jj , the visibil- 
ity is directly connected to the fidelity F = (y t \ p p il v e ? \ w T ) with respect to a target Bell state 
I \j/ T ) via the relation V = (4F — 1) /3 l43l . The relation between visibility and correlation co- 
efficient ^chsh of the CHSH Bell inequality is S CHS1I = 2y/2V, cf. 14411 . Our predictions J5| agree 
with experimental results fl43l : our theory predicts V tha „ y = 77.7%, and the observed visibility in 
experiment was V cxp = (80 ±4)%. 

3. Optimizing QKD performance 

We numerically simulate the effect of real-world imperfections on the two common QKD fig- 
ures of merit, quantum bit error rate (QBER) and secret key rate R sec , for an entanglement-based 
QKD experiment in which the long-distance quantum channel (with distance d) between sender 
Alice and a receiver Bob is split into shorter segments with two PDC sources placed 1/4 and 
3/4 of the way along the channel and a BSM performed halfway (Fig. [2j. Due to ES, the pho- 
tons distributed between Alice and Bob are entangled, so the BBM92 protocol can be applied 
to produce the key. 
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Fig. 2. Illustration of ES-based QKD. The quantum channel between Alice and Bob is 
split into shorter segments, with two PDC sources placed 1/4 and 3/4 of the way along 
the channel and a joint BSM performed halfway. Given a successful BSM (with success 
probability equal to j1]q), the photons arriving at Alice and Bob are entangled despite 
never having interacted with one another, and the BBM92 protocol can be used to create 
the secret key. 



The QBER, defined as the ratio of wrong bits to the total number of bits exchanged between 
Alice and Bob, is directly related to the visibility V of four-fold coincidence measurements via 
the relation QBER = (1 —V)/2 Q. Hence, it can be computed nonperturbatively using our 
closed-form solution j9j- For compactness, the procedure for computation of V is not repeated 
in the present paper. 

For one-way communication, which we analyze here, according to Shor and Preskill's secu- 
rity proof the secret key yield is |451 

flsec = Rm [1 - Ki/ 2 (QBER) - #2 ( QBER)] . (3) 

The first factor, R s m, is the sifted key rate; it is the number of all coincidental detection events 
(per second) for which Alice and Bob made by chance compatible choices of bases in which 
they measured the received photons. Hence, the sifted key rate is only half that of the raw key 
rate, which consists of the overall number of qubits exchanged between Alice and Bob. The 
raw key rate is obtained as a product of the following probabilities per attempt of ES: (i) the 
probability that both PDCs emit EPPs, which is the product of their photon-pair production 
rates % 2 , respectively, (ii) the probability that the generated photons arrive at the analyzers of 
both Alice and Bob as well as at the BSM device, (iii) the probabilities that the photons that 
arrive at Alice's and Bob's sites are also detected, and (iv) the probability that the BSM is 
successful, which is equal to ^t\q and thus bounded by its maximum value 1/2 l46l . Hence, for 
the QKD scheme considered here, under our assumptions, 

Rm = \x 2 x 2 {^- adlA ynl{\m) = \xW, x i<r" (4) 

The second factor of Eq. <£3j describes the effect of privacy amplification. The two subtracted 
terms k// 2 (QBER) and // 2 (QBER), where 

H 2 (x) = -.dog 2 (x)-(l-x)log 2 (l-x) for xe[0,l] (5) 

is the binary Shannon entropy function, represent the reduction of the key rate due to error 
correction and eavesdropping on the quantum transmission, respectively, with K = 1.22 char- 
acterizing the efficiency of error correction algorithm compared to the Shannon limit 11471 . 

We remark that the Shor-Preskill lower bound for the ratio between the number of secure key 
bits and the number of sifted key bits, as given by Eq. (01, was derived under the assumption 
of perfect sources and detectors; i.e., it was assumed that any source or detector imperfections 
can be absorbed into eavesdropper Eve's attack. The same bound was achieved by Koashi and 
Preskill in their QKD security proof for an arbitrary (possibly faulty) source with the only re- 
striction that the source must not reveal any information to Eve about the basis chosen by Alice 
and Bob for their measurements l48l . This feature is naturally satisfied for our entanglement- 
based PDC-ES-BBM92 QKD. The Koashi-Preskill security proof indicates that source defects 
are efficiently detected by the QKD protocol — in our case the BBM92 protocol rather than 
BB84. This means that Alice and Bob cannot be fooled into accepting a part of the secret key 
that Eve got to know by exploiting source imperfections. 

Both Shor-Preskill 1451 and Koashi-Preskill l48l security proofs rely on the crucial assump- 
tion that Alice's and Bob's measurements are performed on qubits. This assumption is certainly 
not valid for real-world QKD. In our PDC-ES-BBM92 QKD scheme, polarization measure- 
ments are implemented by means of polarization rotators (quarter- and half-wave plates), PBSs 
and threshold detectors acting on multiphoton states in spatio-temporal optical modes. The cor- 
responding detection events are theoretically described by POVMs over the //i/zn/fe-dimensional 
Fock space. Yet, by using squashing techniques [49, 501, which are directly applicable to our 



setup, all detection events of our QKD scheme can indeed be reduced to a statistically equiv- 
alent two-dimensional qubit-based description. The existence of a squashing model permits 
employing the Shor-Preskill lower bound ® for our QKD scheme. It also ensures validity of 
our entanglement verification via four-fold coincidence measurements with (realistic) threshold 
detectors (see l50l ). 

Our results are illustrated in Figs.[3]-[7] Fig.[3]displays the dependence of the QBER on the 
parameter % for various fixed values of the product ad, whereas Fig. [4] shows the QBER's de- 
pendence on ad for various fixed % values. In both figures, 770 and p dc are fixed and interrelated 
by constraint As expected, for a fixed distance, the QBER is large for exceedingly small 
as well as for notably large % values. This dependence can be understood as follows. In the 
case of excessively low photon-pair PDC production rates (exceedingly small % values), most 
detection events arise due to detector dark counts, which contribute noise, thus implying an 
increase of the QBER. As the photon-pair production rate increases, the constant detector noise 
level becomes less relevant so that most detector clicks are due to correctly detecting single 
photons stemming from PDC sources, thereby entailing a low QBER value. On the other hand, 
excessively high photon-pair production rates (large % values) are counterproductive as they 
involve a higher probability of multipair events in the PDC process, thereby making the QBER 
grow. As we observe in Fig. [3] our theory predicts the value of % that minimizes the QBER for 
given channel length and loss coefficient. Conversely, given fixed %, we know how the QBER 




Fig. 3. QBER as a function of x for various values of the normalized distance ad and fixed 
rjo and p ic . The function is plotted for ad = 0, 5, 10, 25 and 50, corresponding, respectively, 
to the curves of lowest- to highest-QBER values in all diagrams, and rjo = 0. 1 & p ic ~ 
3 x 10~ 6 in figures (a) and (b), or rjQ = 0.3 & p^ ~ 10~ 4 in figures (c) and (d). The values 
of Tjo and p ic are related to one another by constraint (O- Figures (a) and (c) display a 
higher resolution for very small % values in both cases. To have R sec > the QBER must 
assume values less than approx. 0.094 if K = 1 .22 (0.11 if K = 1.0). 




Fig. 4. QBER vs ad for various % values and fixed tjq and p iL . The function is plotted 
for % = 10~ 4 , 10~ 3 , 10~ 2 , 0.1, and 0.2, corresponding to the dotted, dot-dashed, dashed, 
gray solid and dark solid curves, respectively, in both diagrams, and (a) T]o = 0. 1 & p ic ~ 
3 x 10~ 6 or (b) t\q = 0.3 & p ic ~ 10~ 4 . The values of rjo and p dl . are related to one another 
by constraint (|2). 



scales with distance d. We also find that, as far as QBER is concerned, lower detector efficiency 
is preferable, given the constraint (0. Note that, to achieve non-vanishing secret key rates the 
QBER must not exceed the value 0.094 if K = 1 .22. (0.1 1 if K = 1 .0). 

However, optimal brightness for QKD is not given by the value of % that minimizes the 
QBER because two effects contribute to 7? sec 's dependence on %. The first contribution is via 
the sifted key rate, which increases proportionally with % A . The second contribution is via the 
QBER in a nontrivial way (see the second factor in Eq. ([3]l). For the highest possible R sec , an 
optimal trade-off between the production rate of final EPPs and the amount of entanglement 
after the ES operation has to be achieved. 

For QKD the relevant quantity to be optimized is the secret key rate R ssc , whose dependence 
on x and Tjo is displayed in Figs. [5] and [6] for various values of ad. Our model reveals the 
optimal x and rjo that maximize the secret key rate for given channel length. We have performed 
a constrained optimization, both with respect to x an d ^Oi assuming constraint $2^ between the 
detector efficiencies and dark counts for APD detectors. The result is presented in Fig. [7] 
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Fig. 5. logi? sec as a function of % for various values of the product ad, and fixed r/o and p ic . 
Plots are displayed for ad = 0,5, 10,25, and 50, corresponding, respectively, to the dark 
solid, gray solid, dashed, dot-dashed and dotted curves in both diagrams, and (a) ryo = 0.1 
p^ ^ 3 x 10~ 6 or (b) TJo = 0.3 & p ic 10~ 4 . Dark count probabilities are related to 



the values of rjo by constraint ©. The value of R Sl 
per single pump-laser pulse. 
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Fig. 6. Secret key rate R sec as a function of % and T70 for various exemplary values of 
the product ad. From left to right: (a) ad = 1, (b) ad = 5, (c) ad = 10, (d) ad = 25, 
(e) ad = 40 and (f) ad = 50. Dark count probabilities are related to the values of Tjo by 
constraint l[2}, respectively. Here R sec is given in terms of the number of secure bits created 
per single pump-laser pulse (precisely: for each attempt of ES, which requires two laser 
pulses, specifically with one per crystal). 




Fig. 7. (a) Optimal % and (b) optimal r/o values for QKD as a function of the product ad. 
The dark count parameter p dc is related to Tjo pt by constraint 



4. Comparison: PDC-ES-BBM92 QKD vs Decoy-BB84 QKD 

Decoy-BB84 QKD, invented to combat QKD vulnerability due to PNS attacks, was shown 
to enable achieving much greater distances than conventional faint-pulse BB84 QKD without 
decoy states |[T9l l22l . Furthermore, decoy-BB84 QKD realizes substantially higher key dis- 
tribution rates than PDC-based BBM92 QKD for medium- and low-loss settings (i.e. short 
distances), while the latter tolerates higher channel losses, hence permitting longer communi- 
cation distance than the former JT3). Additional range extensions are possible by means of ES 
at cost of low communication rates; this fact has been demonstrated for ES based on ideal EPP 
sources in 0161. Here we compare PDC-ES-BBM92 QKD and decoy-BB84 QKD with respect 
to achievable distance. In particular, we analyze the issue whether the advantage of ES-based 
BBM92 QKD with regard to range limits is due to a better scaling with respect to dark counts 
rather than due to a higher tolerance of losses and thus would vanish for promising future de- 
tectors with negligible dark count rates. In the discussion below, the detector efficiency and 
dark counts are assumed not to be constrained. 

For decoy-BB84 QKD, the key generation rate is given by the formula 11201 



where pi denotes the intensity (photon number expectation value) of signal states sent by Alice 
to Bob, is the gain of signal states, is the overall QBER of signal states, Q\ is the gain of 
single-photon states in signal states, e\ is the error rate of single-photon states in signal states, 
and f(x) is the error correction efficiency function. While and can be measured directly 
from the experiment, Q\ and e\ have to be estimated. 

Here we employ the practical vacuum & weak-decoy state method, i.e., a two-decoy-state 
protocol with expected photon numbers Vi = and Vi = V <C 1, which has been shown to 
asymptotically approach the theoretical limit of the most general type of decoy state protocol 
(with an infinite number of decoy states) |20|. See also [21 1 for an efficient and feasible three- 
decoy-state protocol (using vacuum and two decoy states). The weak decoy state method allows 
to lower-bound Q\ and upper-bound e\. Here we use the corresponding bounds derived in fl20l 
as well as definitions of E^ and provided therein. We choose the same error correction 
efficiency as for PDC-ES-BBM92 QKD in Eq. ®, f(E^) = K = 1.22 El. Furthermore, for 
a fair comparison, we assume that only dark counts and other background events contribute to 
E^, while we neglect erroneous detection events due to alignment and stability imperfections 
of the optical system, which have not been accounted for in our model for PDC-ES-BBM92 
QKD either. The optimal choice of v, which depends on the transmission distance, has also 
been analyzed in 1201 ; the optimal v is fairly small (~ 0.1) for all distances. Here we choose 
the fixed value v = 0.1, which is reasonable as shown in GUI . 



We have computed the secret-key rate as a function of ad for both PDC-ES-BBM92 QKD 
(using Eq. (01) and decoy-BB84 QKD (using Eq. © with lower and upper bounds for Q\ and 
e\ from Ref. 1201 ) for detectors with the fixed efficiency 770 = 0.2 and diminishing dark count 
noise, see Fig. [8] Optimal source brightness (i.e., optimal values of % and ji, respectively) has 
been chosen for each value of ad, respectively, so as to achieve highest QKD performance at 
each distance. As demonstrated in Fig. [8] decoy-BB84 QKD permits significantly higher key 
distribution rates for short distances up to the crossover point at which Rf^' rapidly drops to zero 
causing a steep slope of log/?*™ v , while PDC-ES-BBM92 QKD enables much longer range. As 
p ic decreases, the range of both decoy-BB84 QKD and PDC-ES-BBM92 QKD increases and 
the crossover point moves to larger distances. As a consequence, the advantage of PDC-ES- 
BBM92 over decoy-BB84 QKD with respect to range diminishes because the communication 
rate of the former beyond the crossover point becomes gradually prohibitively low. 
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Fig. 8. Comparison between decoy-BB84 and PDC-ES-BBM92 QKD performance for de- 
creasing dark count noise. All three diagrams display the logarithm of R sec vs ad for decoy- 
BB84 QKD (gray curve) and for PDC-ES-BBM92 QKD (dark curve), with optimal choice 
of source brightness for every value of ad, respectively, and the fixed detector efficiency 
170 = 0.2. The detector dark count probabilities are (a) p ic = 1.8 x 1CP 5 (complying with 
constraint ([2J), (b) p ic = 10~ 6 and (c) p ic = 10~ 10 (ignoring constraint (O in (b) and (c)). 



There is no crossover of the curves (corresponding to log/?*™ y and log/?fg C vs ad) for p dc = 0. 
Whereas, in this limit, logR^ keeps decreasing linearly for all ad, \ogRH c eventually drops 
exponentially. Intuitively this is obvious. Under our assumptions, in decoy-BB84 QKD the 
overall QBER, En, and the error rate of single-photon states, e\, are caused only by dark count 
noise; for p^ = both = and e\ = 0, implying, according to Eq. ©, R%g? >Q\/2, which 
decreases exponentially without range limit. In PDC-ES-BBM92 QKD, in addition to dark 
counts, multipair events of PDC sources contribute to the overall quantum bit error rate, so 
p lk = does not imply a vanishing QBER. It is of no practical interest to determine the point 
at which the range of decoy-BB84 QKD outdistances the range achieved in PDC-ES-BBM92 
QKD, because the corresponding key rates become extremely small, thus useless. 

As illustrated in Fig. [9ja), the achievable range in PDC-ES-BBM92 QKD is quite sensitive 
to the choice of PDC source brightness, whereas in decoy-BB84 QKD the key rate and distance 
are fairly stable against a variation of ji. Hence, particularly for PDC-ES-BBM92 QKD, it is 
necessary to optimize the source brightness for each given distance. Furthermore, for negligi- 
ble dark counts, increasing the detector efficiency yields a higher key rate as well as a longer 
distribution range. The impact of detector efficiency increase on QKD performance is more 
significant for PDC-ES-BBM92 QKD than for decoy-BB84 QKD, as shown in Fig. 13b). This 
is easily understandable. In decoy-BB84 QKD photon detections take place only at Bob's site, 
whereas, in ES-based BBM92 QKD, additional detectors are employed at Alice's site as well 
as to perform a BSM. 

5. Conclusions 

ES is a fundamental building block in entanglement-based quantum communication schemes 
over long distances. We propose a nonperturbative theory for practical QKD based on ES. Af- 
ter identifying and characterizing the resources for QKD, we perform constrained optimization 
of QKD performance with respect to PDC sources and detectors for any distance d between 
sender and receiver and for arbitrary loss coefficients. For QKD schemes via a single ES oper- 
ation, the PDC brightness and the detector efficiencies should be tuned so that 0.12<j<0.19 
and 0.25 < Tjo < 0.48 depending on ad and the empirical constraint (O between the detector 
efficiency and dark counts. Our theory assumes only existing technology. Even though we have 
elaborated on PDC sources and APD detectors, our model can straightforwardly be applied to 
other types of realistic EPP sources and detectors. With respect to eavesdropping, we assume 
that the eavesdropper (Eve) exploits all experimental imperfections. Our predictions provide 
useful upper bounds on the ES-based long-distance QKD performance. Although the advantage 
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Fig. 9. (a) Effect of source brightness variation on key generation rate and distribution range 
for fixed T70 = 0.2 and negligible dark counts, p^. = 10~ 12 . In decoy-BB84 QKD, the key 
rate and range are fairly stable against a change of fl (as already pointed out in 1201 ): the 
curves corresponding to fl = 0.8 (dotted) and fl = 0.4 (gray solid) coincide. In PDC-ES- 
BBM92 QKD, the key rate and achievable range depend drastically on source brightness, 
as demonstrated by the curves corresponding to % = 0.174 (dark solid), % = 0.172 (dot- 
dashed) and x = 0.12 (dashed), respectively, (b) Effect of detector efficiency variation on 
key generation rate and distribution range for fixed p L]c = 10~ 12 and fixed source brightness, 
fl = 0.7 and % = 0.120, respectively. Predictions for two different r/o values are shown. 
For T]o = 0.9 yielding the dotted curve for decoy-BB84 and the dashed curve for PDC- 
ES-BBM92 QKD, higher key rates and longer distances are achieved than for rjo = 0. 1 
yielding the gray solid curve for decoy-BB84 and dark solid curve for PDC-ES-BBM92 
QKD. The effect is substantially greater for PDC-ES-BBM92 than for decoy-BB84 QKD. 



of ES-based QKD over faint-pulse decoy-BB84 QKD, with respect to achievable distances, di- 
minishes for detectors with negligibly small dark count rates, ES-based QKD is also important 
as an enabler for quantum repeater-based QKD. 

Our analysis could be further improved by accounting for temporal-mode overlap imper- 
fections on a beam-splitter as well as spectral-mode mismatch. Moreover, we conjecture that 
the optimal PDC brightness could be shifted to higher values by employing (realistic) photon- 
counting detectors instead of threshold detectors. Our closed-form solution for the actual entan- 
gled quantum states prepared by practical ES [[51 allows for inefficient, noisy photon-number 
discriminating detectors for the BSM. The intuition affirms this conjecture and is easily under- 
stood as follows. 

Let us consider the events where a coincidence detection by two threshold detectors for 
modes b and c (in Fig.Q]) is interpreted as a projection onto a Bell state. For threshold detectors, 
a fraction of these cases originates from two (or more) photons impinging on one detector and 
(at least) one photon impinging on the other detector, whenever at least one PDC source has 
a multipair excitation. These harmful erroneous heralding events, which are not identifiable 
by threshold detectors, may result in a failure of the ES operation and thus increase of the 
QBER. On the other hand, unit-efficiency photon-number discriminating detectors would allow 
to identify and discard these undesired events, which yields a lower QBER for equal-source 
brightness or, conversely, allows increasing brightness while keeping the QBER constant. Even 
imperfect photon-number discriminating detectors could reveal and thus enable to eliminate 
the erroneous heralding events to some extent. Hence, optimum brightness for maximal QKD 
performance could be chosen higher than in the case of threshold detectors, and one would 
achieve higher secret-key production rates due to increasing values of the raw-key rate. This 
conjecture is worth examining in view of promising technological advancements with photon- 
number-resolving detectors BTl [32l [36l . 
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